diff --git a/scripts/publish.sh b/scripts/publish.sh
index 41ae26f..577ca52 100755
--- a/scripts/publish.sh
+++ b/scripts/publish.sh
@@ -51,23 +51,37 @@ EOF
   exit 1
 fi
 
-if ! "${DOCKER[@]}" system info --format '{{json .IndexServerAddress}}' 2>/dev/null | grep -q "gitea.04080616.xyz"; then
-  cat <<EOF >&2
-Reminder: authenticate first as the same user that runs the build:
-  ${SUDO:+sudo }docker login gitea.04080616.xyz
-EOF
-fi
+# (Earlier versions checked `docker system info` for the registry — but
+# IndexServerAddress always points at Docker Hub regardless of which
+# registries you've logged into, so the check was a guaranteed false
+# positive. If push fails with 401, run:
+#   ${SUDO:+sudo }docker login gitea.04080616.xyz
 
 IMAGE_TAG="${1:-${DOCKER_IMAGE_TAG:-latest}}"
 ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 PLATFORMS="${CM_IMAGE_PLATFORMS:-linux/amd64}"
 
 if ! "${DOCKER[@]}" buildx version >/dev/null 2>&1; then
-  cat <<'EOF' >&2
-Docker Buildx is required for producing registry-compatible images.
-Install/enable buildx and rerun, for example:
-  docker buildx create --use --name cm-bot-builder
-  docker buildx inspect --bootstrap
+  cat <<EOF >&2
+Docker Buildx isn't reachable as the user this script runs docker as
+(${SUDO:+root via sudo}${SUDO:-current user}).
+
+Likely cause: buildx is installed at the per-user path
+~/.docker/cli-plugins/docker-buildx, which sudo doesn't see.
+
+Pick one fix:
+
+  1) Add yourself to the docker group (works for everything, no sudo):
+       sudo usermod -aG docker \$USER
+       newgrp docker
+       docker login gitea.04080616.xyz
+       NO_SUDO=1 bash scripts/publish.sh ${1:-latest}
+
+  2) Install the buildx plugin system-wide:
+       sudo apt install docker-buildx-plugin
+       sudo docker login gitea.04080616.xyz
+       bash scripts/publish.sh ${1:-latest}
+
 EOF
   exit 1
 fi